We assume the same threat model as prior research on hardware analysis [1]}, [2]}, [3]}, [4]}, [5]}.
The adversary, i.e. reverse engineer, has full access to a flattened gate-level netlist.
He knows the general functionality and is aware of the input and output specifications, but has no knowledge on internal workings.
His goal is to (1) identify the obfuscated element, (2) analyze, and (3) deobfuscate it.
We emphasize that we especially focus on adversaries which employ static analysis to reverse a design, as this is what opaque predicates are designed to protect against.
However, in op::sec::construction::discussion we argue that our construction even remains stealthy to some extend when faced with dynamic analysis.
